Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| repomix | npm | < 1.14.1 | 1.14.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the execGitShallowClone function within src/core/git/gitCommand.ts. The user-supplied remoteBranch argument was not sanitized or properly delimited before being passed to git fetch and git checkout commands executed via child_process.execFileAsync. This allows an attacker to inject arbitrary command-line options. The provided patch confirms this by adding the --end-of-options delimiter to the git command arguments and introducing a new validation function, validateGitRef, which prevents ref names from starting with a '-', a common pattern for command-line options. The vulnerability is a classic argument injection (CWE-88). The function execGitShallowClone is the direct sink where the untrusted input is used to construct and execute a command, making it the primary vulnerable function that would appear in a runtime profile during exploitation.
execGitShallowClonesrc/core/git/gitCommand.ts